02-20-2025 01:41 AM
So, before anyone goes on the "just design a better solution" train. This is more for educational purposes.
We had a lab setup, which when a failover happened, the PAT session was oblivious to this, so stayed "UP".
However, the client system knew, so restarted the TCP process (3 way handshake).
Server and FW PAT session stayed active.
This new 3 way handshake transited the existing PAT session, and the server then sent "RST", (as it should, because why would an active session need a 3 way handshake again).
My query is. When we manually clear a PAT session via CLI in a router or ASA (clear NAT translations, or xlate), does that send a "RST" also in both directions, or does it just disappear and the end systems (if still transmitting) just start another PAT session (which would then be out of sync with new 5tuple, and the connection would fail, timeout, then re-set)?
02-20-2025 02:07 AM
clear xlate not force FW to send RST
clear host or clear conn force FW to send RST
MHM
02-20-2025 02:24 AM
Hello
Good question - TBH no sure of the rst towards the client but it does clear the entry from the nat table and that gets recreated.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide